#!/bin/bash
##############################################################
# 全局函数设置
##############################################################
mk_bak() {
    local file_path="${@: -1}"
    if [ -e "${file_path}" ]
    then
        cp -av "${file_path}" "${file_path}.$(date +%F_%s)"
    else
        echo "error not exist file ${file_path}"
        return 1
    fi
}
###############################################################
# 禁用IPv6
###############################################################
sysctl_path='/etc/sysctl.conf'
typeset -A sysctl_cfg_kv=(
    # ['net.ipv6.conf.all.accept_redirects']='0'
    # ['net.ipv6.conf.default.accept_redirects']='0'
    # ['net.ipv6.conf.all.accept_ra']='0'
    # ['net.ipv6.conf.default.accept_ra']='0'
    [net.ipv6.conf.all.disable_ipv6]='1'
    [net.ipv6.conf.default.disable_ipv6]='1'
    # ['net.ipv4.tcp_syncookies']='1'
    # ['net.ipv4.conf.all.rp_filter']='1'
    # ['net.ipv4.conf.default.rp_filter']='1'
    # ['net.ipv4.conf.all.log_martians']='1'
    # ['net.ipv4.conf.default.log_martians']='1'
    # ['net.ipv4.conf.all.secure_redirects']='0'
    # ['net.ipv4.conf.default.secure_redirects']='0'
    # ['net.ipv4.conf.all.accept_redirects']='0'
    # ['net.ipv4.conf.default.accept_redirects']='0'
    # ['net.ipv4.conf.all.accept_source_route']='0'
    # ['net.ipv4.conf.default.accept_source_route']='0'
    # ['net.ipv4.conf.all.send_redirects']='0'
    # ['net.ipv4.conf.default.send_redirects']='0'
    # ['net.ipv4.ip_forward']='0'
)

mk_bak ${sysctl_path} &&
for key in "${!sysctl_cfg_kv[@]}"
do
    value=${sysctl_cfg_kv[$key]}
    if grep -iP "^\s*${key}" ${sysctl_path}
    then
        # 注意：此处Ic表示忽略大小写匹配后替换原配置行
        sed -i -r "/^[ \t]*${key} *=/Ic${key} = ${value}" ${sysctl_path}
    else
        sed -i -r "\$a${key} = ${value}" ${sysctl_path}
    fi
    sysctl -w "${key}=${value}"
done

sysctl -p
systemctl restart NetworkManager

###############################################################
# 修改ssh的banner警告信息
###############################################################

ssh_path='/etc/ssh/sshd_config'
typeset -A sshd_cfg_kv=(
    # ['HostbasedAuthentication']='no'
    # ['IgnoreRhosts']='yes'
    # ['X11Forwarding']='no'
    # ['LogLevel']='INFO'
    # ['Protocol']='2'
    ['Banner']='/etc/ssh_banner'
    # ['LoginGraceTime']='60'
    # ['MACs']='hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com'
)

cp -av "${ssh_path}" "${ssh_path}.$(date +%F_%s)" &&
for key in "${!sshd_cfg_kv[@]}"
do
    value=${sshd_cfg_kv[$key]}
    if grep -iP "^\s*${key}" ${ssh_path}
    then
        # 注意：此处Ic表示忽略大小写匹配后替换原配置行
        sed -i -r "/^[ \t]*${key}/Ic${key} ${value}" ${ssh_path}
    else
        sed -i -r "\$a${key} ${value}" ${ssh_path}
    fi
done
test -f /etc/ssh_banner &&
mk_bak "/etc/ssh_banner" 
echo "Authorized only. All activity will be monitored and reported " > "/etc/ssh_banner"
sshd -t &&
systemctl restart sshd